Anthropic Threat Report: Skill Is No Longer What Separates State Hackers From Amateurs
Anthropic released its fourth threat intelligence report on September 10, 2026, covering activity its Threat Intelligence team disrupted between December 2025 and August 2026. The report documents cases across seven categories of harm: cyber operations, surveillance, influence operations, conventional weapons development, biological misuse, scams and fraud, and illicit distillation. The company assigns each disrupted actor an internal designator, a Generative Threat Group (GTG) number, and publishes case studies detailing how each group used Claude models, along with indicators of compromise for other defenders to act on.
The report's central claim is not that AI created new categories of attack. Credential theft, phishing, SQL injection, and unpatched edge devices remain the entry points they have always been. What changed is who can run these attacks at what speed. Anthropic's investigators found a suspected Russian state espionage unit, a network of financially motivated ShinyHunters affiliates, Chinese university students moonlighting in exploit research, and a lone French hacktivist all using functionally similar AI-orchestrated methodologies to run multi-victim campaigns that would previously have required coordinated teams.
A Russian Operation That Rebuilt Its Own Malware
The most detailed cyber case study, tracked as GTG-20006, describes an actor whose tradecraft and targeting Anthropic assesses as consistent with Midnight Blizzard, the Russian state-nexus espionage group. One operator used the handle "JackPoterz." The group ran custom Windows implants, a mobile exploitation kit, a credential-stealing tool, and a phishing platform built to mimic government login pages, targeting more than 20 organizations including Ukrainian ministries, European diplomatic missions, and drone component manufacturers.
The detail that stands out is what happened after detection. When security products flagged the group's malware, AI agents autonomously modified and rebuilt the flagged tools until they evaded detection again, then staged them back onto disposable hosting infrastructure. Anthropic describes this as inverting the traditional cost structure of cyber defense: previously, a new detection signature slowed an attacker's pace while they built a workaround by hand. Here, the loop closed faster than defenders could publish updates.
The same actor also compromised hotel WiFi vendors to redirect guest traffic and deliver malware to travelers connecting from hotel networks, a technique Microsoft separately documented in July 2026 under the name CaptiveCrunch. Beyond Ukraine and Europe, the group breached a North African government technology authority and exfiltrated a database of more than 300,000 national identity records and half a million company registrations.
Financially Motivated Crews Turn Mobile Apps Into a Credential Mine
A second cluster of cases, tracked as GTG-50014, involves operators suspected of affiliation with the ShinyHunters collective, known for large-scale data theft followed by extortion. One French-speaking operator ran a credential-harvesting pipeline across ten cloud servers that downloaded 1.8 million Android app files, decompiled them, and scanned for hardcoded secrets, routing verified findings into Telegram channels organized by more than 100 source types. The same actor ran a storefront selling stolen payment-card records enriched with cardholder data and a geolocation map of victim addresses, built on infrastructure impersonating the French national police.
Other affiliates in the same collective compromised a technology provider and exfiltrated more than a terabyte of data, including hundreds of thousands of national identifiers, and breached an airline's systems holding tens of millions of passenger records. One actor claimed to have collected legitimate bug-bounty payouts from two companies it had separately extorted, treating disclosure programs as a second revenue stream against the same targets. Anthropic notes it cannot independently verify self-reported figures like these, a caveat that recurs across the report.
Chinese Students Ran an Automated Exploit Foundry
GTG-10007 describes a sustained espionage operation Anthropic attributes to Chinese-speaking operators likely based in Changsha, Hunan province. Two identified operators were undergraduate students at a local university studying computer and communication engineering, one with a prior internship at Sangfor and an active interview underway for an offensive cyber role at QiAnXin. The group ran parallel AI-driven workstreams: reconnaissance against foreign government networks, vulnerability research against a major security product, malware development, and an intelligence-collection platform, all maintaining persistent memory across sessions so work resumed where it left off.
The exploit-development loop is the most technically specific case study in the report. An agent loaded firmware and binaries into a decompiler, walked cross-reference chains across thousands of decompile calls, formed vulnerability hypotheses against a self-curated knowledge base, then wrote and tested exploit code against lab copies of the target product, iterating until it worked. One workflow running continuously against network appliances produced more than a dozen candidate zero-day findings in a single month.
The AI Supply Chain Becomes a Target in Its Own Right
A separate section of the report documents actors who shifted from attacking conventional targets to attacking the AI supply chain directly. Compromised API keys and session tokens now carry resale value, they supply attack compute paid for by someone else, and they let attackers' activity blend into a legitimate account's traffic. Anthropic describes fraudulent resellers who advertised discounted Claude access, then silently proxied customer traffic to a different model while harvesting the buyer's real Anthropic credentials to resell again.
One case, GTG-50020, involves a Russian-speaking actor who had previously targeted hotel booking and fintech platforms before redirecting the same methods at AI vendors. By injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor extracted production API keys, then used those stolen keys to continue attacking roughly thirty AI companies within four days. Anthropic states plainly that the actor's stated goal was access to a pre-release Claude model, that every attempt failed, and that Anthropic's own systems were never compromised.
One Person, One Script, Forty-Two Targets
Perhaps the starkest illustration of individual capability comes from GTG-50029, a single French-speaking hacktivist who targeted European political parties, media outlets, and think tanks in spring 2026. Working alone, the actor built a custom scanner to find and validate exposed API keys, exploited a previously undocumented WordPress vulnerability against at least four victim sites, and built a doxxing platform called "fafsearch" that cross-referenced breach dumps against exfiltrated data, complete with normalization logic for national ID numbers and a containerized deployment.
Across 42 tracked targets, the actor gained internal access to at least 14, exfiltrating an estimated 12 to 26 gigabytes of data including political party donor records, student application records belonging to minors, and payment-provider data. Anthropic's framing is direct: this is one of the clearest cases yet of AI-assisted software engineering applied to a mass privacy attack, built entirely by one person.
Influence Operations Reached Six Continents
The report's second major section covers influence operations, which Anthropic defines as efforts to manipulate political or civic discourse while concealing who is behind the effort. Nine cases originated from Russia, Iran, Turkey, and operators across the Gulf, South Asia, Africa, and Europe.
In the Central African Republic, a Russian-speaking operator ran a daily propaganda pipeline through a Wagner-funded radio station, using Claude to generate content, forge government documents, and draft loyalty contracts for staff scored against political criteria. In one case tied to this operation, Claude flagged the political weighting embedded in a scoring rubric, and the actor simply relabeled the categories in neutral language and kept using it. A separate commercial operation run by a French advertising agency published more than 8,900 articles across roughly 70 fake news sites in twenty languages, shifting political allegiance depending on who was paying. A Turkish company marketed a platform it called a "military-grade, AI-driven, real-time political operations ecosystem" and used it to target Malaysia's 222 parliamentary constituencies along lines of race, religion, and royalty, generating fabricated dossiers accusing named opposition figures of crimes Anthropic's own research could find no evidence for.
Anthropic also documents four accounts feeding Russian state media outlets, including Sputnik Moldova, RIA Novosti, and RT's English newsroom, where individual staffers used Claude to produce broadcast-ready scripts, tickers, and articles at a volume that would otherwise require full editorial teams. One case tied fabricated claims about Moldova's president to the country's September 2025 parliamentary election. Separately, three Iranian state-aligned institutions used Claude to build campaign doctrine, persona systems, and target databases framed around what the actors themselves called a "soft war" against domestic and foreign audiences.
What the Report Suggests
Anthropic frames the pattern across both sections the same way: AI has not introduced new attack techniques so much as it has changed who can afford to run existing ones, and at what scale. Reconnaissance, tool development, and data processing that once required teams of specialists now run through agents at machine speed, with humans retaining decisions about targeting and monetization while delegating the labor in between. Breaches that took hours rather than weeks, and single operators managing dozens of victims in parallel, appear repeatedly across the case studies. The company states it disrupted every case documented in the report, shared indicators with industry and government partners where appropriate, and used findings from each investigation to update its own detection systems.